Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

651–660 of 701 posts

Re: WD My Book users wake up to find their data deleted

#651

Earlier quoted context omitted.

> There's really no winning with this. There is: don't release devices with security flaws in the first place. The fact is, they released a fatally flawed device. That the flaw was discovered later doesn't change that fact. I think the way we talk about security patches and updates obscures the fact that they're correcting fundamentally flawed software. In other circumstances, this would result in product recalls. Th…

Software should be more secure. However I don't think it's realistic to expect bug-free perfectly secure software. There is no field of engineering where 100% perfect tolerances are possible, and when you start getting past 99% the resource requirements to get to the next fraction of a % quickly go non-linear. This is why 1) Security patches will pretty much always be necessary and 2) relying on perfect software alon…

Exposing IoT to the world is (going to be) common with IPv6, not sure how much SLAAC privacy extensions and "temporary" (hours to days ?) addresses help ?

Re: WD My Book users wake up to find their data deleted

#652
post #632

Earlier quoted context omitted.

What, no "Stallman was right?" Okay. Stallman was right. I know it's cliche, I know he's weird. But I learned a LONG TIME AGO never to bet against the man's predictions and ideas on software. He called all of this, and quite a few people (especially HERE) would do well to get back to fundamentals and work on fixing it.

You're not wrong, Walter, ...

Imagine being that right, that often, on things that important - and being ignored / smeared / mocked for your trouble.

Re: WD My Book users wake up to find their data deleted

#654

Afaik their accessible remotely over the internet via the WD MyCloud was just a custom daemon running in the background on the device. Suspect there was a remote backdoor most likely for tech support.

Even worse it was a known CVE - the firmware update was in 2015.

Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands.

Re: WD My Book users wake up to find their data deleted

#655
post #555

Earlier quoted context omitted.

> PC hardware isn't ideal because you lose the benefits of specialised offload capabilities. Just so you know, this isn't true. Nothing stops hardware offload from being put in a PCIe slot (that's where it tends to have started actually). And indeed that's a fairly standard thing on decent NICs, which don't have to be particularly expensive if you buy used. I've switched to OPNsense for routing functionality at all s…

> Just so you know, this isn't true. Given my statement, you're correct, but what I meant to say was; I can't just take a random PC (-like) device and expect hardware offload or other similar capabilities, I still have to buy specialised hardware, a suitable NIC, e.g Intel. I make a point of buying Intel NICs for this purpose. > But I'd caution against depending on them for routing I agree. I've been running Ubiquiti…

>I can't just take a random PC (-like) device and expect hardware offload or other similar capabilities, I still have to buy specialised hardware, a suitable NIC, e.g Intel. I make a point of buying Intel NICs for this purpose.

I mean sure, you can't just take an entirely random PC, but then if you just grab any completely random AIO piece of junk you're probably not going to get a great experience either, "hardware offload" or not. The variety of kit available, particularly used, that has even built-in Intel networking chipsets which work is wide enough and cheap enough that it doesn't seem like a particularly limiting factor.

>I agree. I've been running Ubiquiti for 5+ years now at home. At the time nobody was recommending against them, quite the opposite in fact. I use EdgeMax/EdgeSwitch/EdgeRouter + UniFi APs.

Yeah, when I started with Ubiquiti they were excellent with much promise to come. Unfortunately their CEO is a mixture of toxic as hell and seems only semi-invested at this point while also having complete company control (don't let the "public" aspect fool you, he has a super majority of the shares) and has torpedoed their talent pool and vision. Damn shame, I don't know of anyone else pursuing quite the same thing at all.

I wouldn't bother with them for LAN stuff (their PtP/PtMP is still pretty competitive and useful) greenfield at this point, but even so I think they're fine on the switching side and acceptable for an existing investment on the WAP side. For switching they stopped being as feature/price competitive a while ago, but that doesn't harm the basic functionality. I have doubts about them navigating the multigig or WiFi 6E/7 transitions, they've been able to coast on old talent and investment by people no longer there for a long time. But that won't get pressing for a while so it's not a driver.

The gateway aspects definitely are though, awful. Edge is certainly somewhat better, but even there one can see the stagnation and rot.

>I've considered getting a PCEngines device because of the open/libre bootloader (uboot), when the EdgeRouter finally kicks it. It's nice and compact like a router, I can stick in my 12u network rack cabinet, and I'll be able to keep it up to date for longer as well as integrate it better with the tools I use.

I considered them as well as a range of others that supported coreboot. But in the end since I have a rack in a more out of the way place I just waited for a good 1U server deal to turn up on Ebay and grabbed a few of those. I have a decent SuperMicro system and a few HP DL20s, Provantage even briefly had a bunch up brand new for $350. For something as important as a gateway, it's actually kind of nice to have things like full lights-out-management and kit that's all designed to run 24/7 for years. 1U stuff of course tends to be noisier, but swapping fans for something quieter even at 40mm has tended to work pretty well for me in this application since they tend to be relatively power sipping (at least for x86). No GPUs, no big stonking 100W+ CPUs, not a whole lot to watts dissipate even in that form factor. Though too bad there don't seem to be more options without going custom for something SoHo/SMB focused that could trade Us for noise a bit more. Maybe that'll come around, in data centers density is king of course but I recall reading some articles that even there, let alone in company IT rooms/closets, there has been a growing appreciation about the dangers of high workplace noise levels.

Re: WD My Book users wake up to find their data deleted

#656
post #627
post #310

Earlier quoted context omitted.

After using exclusively WD for some decades I've seen the WD Red fiasco[1] and decided to not use WD any more. [1]: https://blocksandfiles.com/2020/04/14/wd-red-nas-drives-shin...

What are you using now? Seagate is the other big consumer brand and they also have their own set of issues. Anecdotally, I've had multiple Seagate drives die within a year or 2 whereas WD ones have kept going for years longer.

Seagate's anecdotal failure rate was why I kept to WD. Backblaze's numbers convinced me this is not a problem I need to worry about in the present. Seagate had much better price/performance than Toshiba in my local market when I last needed drives, so it's what I got.

Re: WD My Book users wake up to find their data deleted

#657

Earlier quoted context omitted.

> But consumer electronics are written off on much shorter timeframes than cars. They are, but it kills the planet. We have 12 year old PCs in the family. Well, back then they were high-end models bought for work. Now they are running Linux just fine for general family purpose. They use a bit more of energy than a new model, but where we live you have to heat buildings at least 8 months a year anyway. I am sure produ…

It's also important to point out that despite using more energy because it's older hardware, it'll use considerably less energy during its all life, than it takes to produce a new computer. Replacing old hardware with "more energy-efficient" hardware is a trap from green capitalism and the numbers do not add up usually.

I find this claim a little hard to believe. Data centers routinely replace ~3 year old computers because the number of old computers they would need to keep running and cooling exceeds the cost of new more efficient hardware. The price of new hardware includes all the energy costs of producing it. Obviously the environmental externalities of energy aren't fully priced in, but that is also the case for data center energy.

What might be a more useful comparison is a $20 5W raspberry pi vs. a 2009 100W (at best) desktop computer where a month of continuous desktop operation costs more in energy than the new raspberry pi and ~1 year of usage.

Re: WD My Book users wake up to find their data deleted

#658

Earlier quoted context omitted.

> I get that it doesn't make sense to offer parts for 20yo cars Why not? Personally i believe a hardware manufacturer should be bound by law to sell parts for any vehicle it sold in the past, as long as it exists. Yes even if it was produced 40 years ago. There's no reason for it to be otherwise. If this was mandated by law all the tiny incompatibilities that they introduce with very varied models will suddenly go aw…

“a hardware manufacturer should be bound by law to sell parts for any vehicle it sold in the past, as long as it exists” Cars would get extremely expensive. Imagine Ford still having to supply model T wheels and engines. They either would have to have kept a production line and employees knowing to operate it around, or have stocked ‘enough’ parts, where ‘enough’ is very hard to estimate up front. Also, stocked parts…

I'd expect each new model to be launched as its own business, licensing out the design.

Said business would eventually declare bankruptcy and stop making the parts

Re: WD My Book users wake up to find their data deleted

#659
This has an official security notice now https://www.westerndigital.com/support/productsecurity/wdc-2...

that references a NIST vulnerability report https://nvd.nist.gov/vuln/detail/CVE-2018-18472 ..that references the original bug report that WD refused to address due to warranty stuff etc. https://www.wizcase.com/blog/hack-2018/

wow.

Re: WD My Book users wake up to find their data deleted

#660

Earlier quoted context omitted.

I find the environmental impact argument here to be very dubious. Even if a Linux-like alternative were available for this hard drive, the vast majority of people would be unaware of that or not willing/capable of figuring out how to work it and would throw the device away and replace it anyway. And even if they did save the hard drive, they might just use the money they saved by not replacing it to upgrade their com…

Hard drives are a mediocre example, but I have exactly such an enclosure sitting around that I use as cold-storage because I know better than to connect it to a network. If I want to get data off it, I set up an isolated segment in RFC3927 space. As a result, I've bought a new NAS-type device which does have supported software and which I can put on a live network with only minimal worry. (I still take backups of cou…

> If I want to get data off it, I set up an isolated segment in RFC3927 space.

Do you really not see how completely unrealistic this is for the average consumer, and honestly the majority of HN readers?

Post reply on HN